feat(media): declarative stacks/Media *arr shapes, NFS-hardened (#105)

[ChrisonSimtian]

Authors the *arr media stack as declarative homelab/v1 shapes (issue #105) — a fresh 5100 CTID block on hpe-01 (co-located with Plex), built in parallel with the live hand-built 5000s CTs for later cutover. Author-only this round — no live deploy (deferred to the MacBook).

What's here

• stacks/Media/stack.yaml — CTID block 5100–5199 + shared defaults (debian 13, VLAN 1010, hpe-01, onboot).
• 7 members — prowlarr (5100), sonarr (5101), radarr (5102), bazarr (5103), qbittorrent (5104), seerr (5105), flaresolverr (5107). dependsOn ordering, acyclic; 5106 reserved (future 2nd torrent client).
• The load-bearing constraint — the 4 file-touching members (sonarr/radarr/bazarr/qbittorrent) bind the same volume4 export at /data (TRaSH hardlinks) via BL-016's shared-export path-bind (type: nfs + storage + source: data, no size) plus a pre-start hookscript (snippets/ensure-data-mount.sh) that refuses to start unless the NAS is mounted — designs out the CT 5007 rootfs-fill race. prowlarr/seerr/flaresolverr get no /data.
• app-catalogue.yaml — 7 new slugs (create-only; no converge provisioners — DefaultProvisioner handles them).
• docs/runbooks/volume4-data-export.md — the volume4 prerequisite (Synology export with squash + setgid + default ACLs for the no-PUID/PGID *arr apps, Proxmox storage) and the manual mount/hookscript apply steps.
• .gitattributes — *.sh eol=lf so the hookscript survives a Windows checkout (the repo had no gitattributes; one existing .sh was already CRLF in-index).

Validation

All 8 shapes pass JSON Schema (draft 2020-12) against shape.schema.json; a loader-rules check confirms ctids in range, dependsOn targets resolve, and the graph is acyclic. (Engine validate/build not runnable on this box — no GITHUB_PACKAGES_PAT.)

Deliberately NOT done

• volume4 isn't wired yet (Chris confirmed) — the runbook covers the manual DSM + Proxmox steps; deploy waits on it.
• converge doesn't apply mounts/hookscript yet (engine gap). --apply creates the CT + reconciles cores/memory/tags (Converge: destroy + update lifecycle + richer state diff #101) but not mounts — documented in the stack README; manual until a converge mount-apply increment lands (good candidate for the next issue).
• Live deploy + cutover (indexer DB restore, Recyclarr profiles, library curation) → MacBook, per the plan.

Refs #105.

🤖 Generated with Claude Code

[ChrisonSimtian]

Superseded by #139 and the broader Media-stack rebuild (ADR-0006). Closing — but keeping the spirit alive; the good parts are carried forward, nothing lost:

• *The 7 arr shapes (prowlarr/sonarr/radarr/bazarr/qbittorrent/seerr/flaresolverr), CTID 5100–5107 (5106 reserved) + dependsOn ordering.
• The shared /data mount model — type:nfs, storage:ds1813-nfs-volume-4, source:data, target:/data, acl:true, backup:false. (This is the same model the new work landed on.)
• snippets/ensure-data-mount.sh pre-start hookscript — confirmed required: a shared subpath path-bind is not Proxmox storage-gated, so the guard stays. (See the runtime-NAS-loss discussion — likely extended beyond pre-start.)
• docs/runbooks/volume4-data-export.md — the volume4 prerequisite/ownership reference.
• .gitattributes (*.sh eol=lf).

What the consolidated stack adds on top: the cloudflared connector + flat <svc>.chrison.dev (ADR-0006), and the volume4 export is now SynoSharp-automated (Chrison-dev/SynoSharp#9) instead of a manual DSM step. Refs #105.